LDAP Signing Not Enforced

Where an Active Directory domain controller's LDAP service is reachable from the Internet, an operator can test its signing state and relay a live NTLM authentication exchange to it without an internal network foothold. If the target accepts unsigned LDAP SASL binds and the relayed identity has the necessary directory rights, the relay can perform only the LDAP reads or modifications permitted to that identity. Other deployments require internal network access. This configuration weakness does not itself reveal a plaintext password or execute remote commands.